---
name: publish-record
description: How a partner issues - publish a signed Regulatory Compliance Object to the RCO-A2A partner rail through the APIM door.
---

# How a partner issues

GSC never authors your record and never holds your private key. GSC verifies, receipts, and serves. The write path accepts only what already verifies.

## Once: become an issuer

1. Admission is a signed row in the consortium registry (https://consortium-10060.org/issuers.json): your issuer id, rail `cpg`, YOUR JWKS URL, status, admitted date, your slot block on rco-a2a-cpg.ai, contact. Request a seat at the GSC Trading Desk (https://gsc-navigator.ai/).
2. Subscribe in the developer portal (https://gsc-rco-partner.developer.azure-api.net, product "Partner Issuers", approval required). One subscription key per issuer.

## Per record

1. Author the RCO (schema: https://rco-a2a.ai/schema/v1.3/rco-record-v1.json): keyed GTIN x jurisdiction, `issuer.id` = your id, `issuer.rail` = `cpg`, `verification_url` = YOUR registry JWKS URL, `record_id` = `rco:<your-id>:<object>:<jurisdiction>:<n>`.
2. Sign it with YOUR key: detached JWS Compact (RFC 7515 + RFC 7797 `b64:false`), ES256, signing input = `ASCII(BASE64URL(protected) || '.') || RFC 8785 canonical JSON of the record minus signature`. Test vectors: https://rco-a2a.ai/schema/v1.2/signature-test-vectors.json.
3. POST to the door with your key:

```
POST https://gsc-rco-partner.azure-api.net/partner/mcp
Ocp-Apim-Subscription-Key: <your key>
{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"publish_record","arguments":{"record":{...}}}}
```

4. A 200 returns your slot, the record URL (colons on the wire), and the Azure Confidential Ledger receipt. Rejection is a typed error and your record is never modified. Idempotent: republishing identical bytes returns the same receipt.

The door only accepts `publish_record`; every read stays keyless on the public MCP at https://mcp.rco-a2a.ai/mcp.